We deploy WPA3-EAP for co-working spaces (EU/US). That means BYOD and no ability to enforce MDM.
Each co-working space issue wifi credentials to their individual members, usually in the form of PEAP/TTLS.
The user joins the SSID for EAP and is prompted to enter username + password, and then to accepts our radius certificate (prompted as "not trusted" of course).
Does the certificate validity period of 825 days or fewer apply to our radius leaf certs?
The question has come up as we read:
https://support.apple.com/en-us/102028
--"This change will not affect certificates issued from user-added or administrator-added Root CAs"
https://support.apple.com/en-ca/103769
--"Additionally, all TLS server certificates issued after July 1, 2019 (as indicated in the NotBefore field of the certificate) must follow these guidelines:"
..... "TLS server certificates must have a validity period of 825 days or fewer (as expressed in the NotBefore and NotAfter fields of the certificate)."
lastly, while PEAP/TTLS is the primary method. Second is delivering a .mobileconfig that can be downloaded by the user containing EAP-TLS authentication. These also require user acceptance as there again is no MDM possible.
We dont have any issues currently, but are we going to wake up one morning and find that all apple devices have dropped off the networks?